Loading story…
Red Hat released Important security updates for httpd:2.4 across multiple Red Hat Enterprise Linux 8 support channels to remediate two Apache HTTP Server vulnerabilities, CVE-2025-55753 and CVE-2025-58098. The first flaw affects mod_md ACME certificate renewal handling in Apache HTTP Server versions 2.4.30 through 2.4.65, where an integer overflow can drive the renewal backoff timer to zero after repeated failures and trigger continuous retry attempts until renewal succeeds. The second flaw affects Apache HTTP Server before 2.4.66 when Server Side Includes is enabled with mod_cgid, causing the shell-escaped query string to be passed to SSI #exec cmd="..." directives.
The fixes were shipped through advisories including RHSA-2026:0009, RHSA-2026:0010, RHSA-2026:0011, and RHSA-2026:0012, covering RHEL 8.2, 8.4, 8.6, and 8.8 service variants such as AUS, EUS, SAP, Telecommunications, and Advanced Mission Critical Update Support. Updated packages include httpd, mod_md, mod_http2, mod_ssl, mod_ldap, mod_proxy_html, and mod_session for supported architectures, while Apache identified version 2.4.66 as the upstream fix level for both issues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-01-05, Red Hat issued RHSA-2026:0012, an Important httpd:2.4 security update for RHEL 8.8 Update Services for SAP Solutions, Telecommunications Update Service, and related variants. The update fixes CVE-2025-55753 and CVE-2025-58098 in Apache HTTP Server packages.
On 2026-01-05, Red Hat issued RHSA-2026:0011, an Important httpd:2.4 update for RHEL 8.6 Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. The advisory addresses both CVE-2025-55753 and CVE-2025-58098.
On 2026-01-05, Red Hat issued RHSA-2026:0010, an Important httpd:2.4 advisory for RHEL 8.4 Advanced Mission Critical Update Support and 8.4 Extended Update Support Long-Life Add-On. The advisory delivers fixes for CVE-2025-55753 and CVE-2025-58098.
On 2026-01-05, Red Hat issued RHSA-2026:0009, an Important httpd:2.4 security advisory for Red Hat Enterprise Linux Server - AUS 8.2 x86_64. The update remediates CVE-2025-55753 and CVE-2025-58098 with updated Apache HTTP Server packages.
Apache HTTP Server fixed CVE-2025-55753, an integer overflow in mod_md ACME renewal backoff handling, and CVE-2025-58098, an SSI and mod_cgid issue that passes the shell-escaped query string to #exec cmd directives. Both Bugzilla records state the issues affect versions before 2.4.66 and recommend upgrading to 2.4.66.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat published **Important** security updates for Apache HTTP Server packages across **Red Hat Enterprise Linux 8, 9, and 10** and related JBoss Core Services offerings, addressing multiple upstream `httpd` vulnerabilities. The updates remediate **CVE-2025-65082**, which can let Apache configuration-set variables unexpectedly override server-calculated CGI environment variables, and **CVE-2025-66200**, a `mod_userdir` + `suexec` bypass in which an attacker able to use the `RequestHeader` directive in an `.htaccess` file may cause some CGI scripts to run under an unexpected user ID. Red Hat advisories for RHEL 9 and 10 also include fixes for **CVE-2025-58098**, where Server Side Includes appends the query string to `#exec cmd`, while the RHEL 8 `httpd:2.4` module update additionally addresses **CVE-2025-55753**. The affected Apache HTTP Server ranges extend through **2.4.65**, and upstream guidance points users to **2.4.66** for remediation. Red Hat shipped patched builds including `httpd-2.4.62-7.el9_7.3` for RHEL 9 and `httpd-2.4.63-4.el10_1.3` for RHEL 10, with corresponding package updates across major architectures and lifecycle channels; the RHEL 8 advisory likewise delivers updated `httpd`, `mod_ssl`, `mod_http2`, `mod_md`, and related components. The fixes were released under advisories **RHSA-2025:23732**, **RHSA-2025:23919**, and **RHSA-2025:23932**.
Aug 21, 2026
The Apache Software Foundation released **Apache HTTP Server 2.4.68** to patch 13 vulnerabilities affecting versions prior to `2.4.68`, with many issues spanning `2.4.0` through `2.4.67`. The flaws span multiple modules, including `mod_http2`, `mod_proxy_ftp`, `mod_proxy_html`, `mod_ssl`, `mod_ldap`, `mod_dav_fs`, `mod_xml2enc`, and `mod_headers`, and include use-after-free, heap and buffer overflows, out-of-bounds reads, denial-of-service conditions, cross-site scripting, privilege-escalation and path-handling weaknesses. Apache and national defenders, including Canada’s Cyber Centre, urged administrators to review the advisory and upgrade because workarounds are unavailable for most of the issues. Notable CVEs include `CVE-2026-49975`, a `mod_http2` denial-of-service bug triggered by excessive size values in malicious HTTP/2 requests; `CVE-2026-48913`, a `mod_http2` memory-corruption issue when file handles are exhausted; `CVE-2026-34355` and `CVE-2026-34356`, buffer-overflow flaws tied to untrusted backend systems in `mod_proxy_html` and `ProxyPassReverseCookie*`; `CVE-2026-44631`, a heap underflow in `ap_regname` caused by crafted regular expressions; `CVE-2026-29167`, a `mod_ldap` per-directory use-after-free; `CVE-2026-29170` and `CVE-2026-44186` in `mod_proxy_ftp`; `CVE-2026-44185` in `mod_ssl` OCSP handling; and `CVE-2026-42535` in `mod_dav_fs`. The release also ships non-security changes such as OpenSSL 4.0 support and `mod_http2` updates, but the immediate priority for exposed environments is upgrading all Apache HTTP Server deployments to `2.4.68`.
Jun 29, 2026
The Apache Software Foundation released **Apache HTTP Server 2.4.67** to fix five vulnerabilities, led by **`CVE-2026-23918`**, an important- to high-severity flaw in the HTTP/2 implementation. Apache said the bug is a **double free** triggered by an early reset that could lead to **remote code execution**, and that it affects **version 2.4.66**. The issue was reported in December 2025 and fixed shortly afterward, with public disclosure following on the `oss-sec` mailing list; Bartlomiej Dmitruk of striga.ai and Stanislaw Strzalkowski of isec.pl were credited with finding it. The 2.4.67 release also patches **`CVE-2026-24072`** in `mod_rewrite`, which can allow local `.htaccess` authors to read arbitrary files as the `httpd` user, along with lower-severity issues in `mod_proxy_ajp`, `mod_md`, and `mod_dav_lock`. Apache and downstream reporting urged organizations running **2.4.66 or earlier** to upgrade immediately, while temporary mitigations for environments that cannot patch at once include disabling **HTTP/2**, removing `mod_dav_lock`, and reviewing `.htaccess` permissions.
Jun 29, 2026